From: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
To: Simon Horman <horms@kernel.org>
Cc: Jesse Brandeburg <jesse.brandeburg@intel.com>,
Tony Nguyen <anthony.l.nguyen@intel.com>,
Alexei Starovoitov <ast@kernel.org>,
"Andre Guedes" <andre.guedes@intel.com>,
Dan Carpenter <dan.carpenter@linaro.org>,
Daniel Borkmann <daniel@iogearbox.net>,
"David S. Miller" <davem@davemloft.net>,
Eric Dumazet <edumazet@google.com>,
Florian Kauer <florian.kauer@linutronix.de>,
Jakub Kicinski <kuba@kernel.org>,
"Jesper Dangaard Brouer" <hawk@kernel.org>,
Jithu Joseph <jithu.joseph@intel.com>,
John Fastabend <john.fastabend@gmail.com>,
Paolo Abeni <pabeni@redhat.com>,
Vedang Patel <vedang.patel@intel.com>,
<intel-wired-lan@lists.osuosl.org>, <netdev@vger.kernel.org>,
<bpf@vger.kernel.org>
Subject: Re: [PATCH RFC net] igc: Avoid dereference of ptr_err in igc_clean_rx_irq()
Date: Thu, 15 Jun 2023 14:09:45 +0200 [thread overview]
Message-ID: <ZIr/iX7qNbUpXocP@boxer> (raw)
In-Reply-To: <ZIr1s6KHVGh/ZuEj@kernel.org>
On Thu, Jun 15, 2023 at 01:27:47PM +0200, Simon Horman wrote:
> On Thu, Jun 15, 2023 at 11:55:29AM +0200, Maciej Fijalkowski wrote:
> > On Thu, Jun 15, 2023 at 11:45:36AM +0200, Simon Horman wrote:
>
> Hi Marciej,
>
> > Hi Simon,
> >
> > > In igc_clean_rx_irq() the result of a call to igc_xdp_run_prog() is assigned
> > > to the skb local variable. This may be an ERR_PTR.
> > >
> > > A little later the following is executed, which seems to be a
> > > possible dereference of an ERR_PTR.
> > >
> > > total_bytes += skb->len;
> > >
> > > Avoid this problem by continuing the loop in which all of the
> > > above occurs once the handling of the NULL case completes.
> > >
> > > This proposed fix is speculative - I do not have deep knowledge of this
> > > driver. And I am concerned about the effect of skipping the following
> > > logic:
> > >
> > > igc_put_rx_buffer(rx_ring, rx_buffer, rx_buffer_pgcnt);
> > > cleaned_count++;
> >
> > this will break - you have to recycle the buffer to have it going.
>
> Thanks. As I said I wasn't sure about the fix: it was a strawman.
>
> > > Flagged by Smatch as:
> > >
> > > .../igc_main.c:2467 igc_xdp_run_prog() warn: passing zero to 'ERR_PTR'
> >
> > how about PTR_ERR_OR_ZERO() ? this would silence smatch and is not an
> > intrusive change. another way is to get rid of ERR_PTR() around skb/xdp
> > run result but i think the former would be just fine.
>
> Sorry, there were two warnings. And I accidently trimmed the one
> that is more relevant instead of the one that is less relevant.
> I do agree the one above does not appear to be a bug.
>
> But I am concerned abut this one:
>
> .../igc_main.c:2618 igc_clean_rx_irq() error: 'skb' dereferencing possible ERR_PTR()
>
> If skb is an error pointer, e.g. ERR_PTR(-IGC_XDP_PASS), and
> it is dereferenced, that would be a problem, right?
IGC_XDP_PASS is 0. -0 is still 0 right?
this means skb is NULL and igc_{build,construct}_skb() will init it. For
ERR_PTR, igc_cleanup_headers() does IS_ERR() against it and continues. So
you will get to line 2618 only for valid skb, it just happens that logic
is written in a way that skb is supposed to carry XDP return code. We
removed this in ice for example but i40e works like that for many years
without issues, AFAICT...
>
> Perhaps I'm missing something obvious and this can't occur.
> But it does seem possible to me.
>
> >
> > >
> > > Compile tested only.
> > >
> > > Fixes: 26575105d6ed ("igc: Add initial XDP support")
> > > Signed-off-by: Simon Horman <horms@kernel.org>
> > > ---
> > > drivers/net/ethernet/intel/igc/igc_main.c | 1 +
> > > 1 file changed, 1 insertion(+)
> > >
> > > diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c
> > > index 88145c30c919..b58c8a674bd1 100644
> > > --- a/drivers/net/ethernet/intel/igc/igc_main.c
> > > +++ b/drivers/net/ethernet/intel/igc/igc_main.c
> > > @@ -2586,6 +2586,7 @@ static int igc_clean_rx_irq(struct igc_q_vector *q_vector, const int budget)
> > >
> > > total_packets++;
> > > total_bytes += size;
> > > + continue;
> > > } else if (skb)
> > > igc_add_rx_frag(rx_ring, rx_buffer, skb, size);
> > > else if (ring_uses_build_skb(rx_ring))
> > >
> > >
> >
next prev parent reply other threads:[~2023-06-15 12:10 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-06-15 9:45 [PATCH RFC net] igc: Avoid dereference of ptr_err in igc_clean_rx_irq() Simon Horman
2023-06-15 9:55 ` Maciej Fijalkowski
2023-06-15 11:27 ` Simon Horman
2023-06-15 12:09 ` Maciej Fijalkowski [this message]
2023-06-15 14:14 ` Simon Horman
2023-06-15 14:25 ` Dan Carpenter
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ZIr/iX7qNbUpXocP@boxer \
--to=maciej.fijalkowski@intel.com \
--cc=andre.guedes@intel.com \
--cc=anthony.l.nguyen@intel.com \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=dan.carpenter@linaro.org \
--cc=daniel@iogearbox.net \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=florian.kauer@linutronix.de \
--cc=hawk@kernel.org \
--cc=horms@kernel.org \
--cc=intel-wired-lan@lists.osuosl.org \
--cc=jesse.brandeburg@intel.com \
--cc=jithu.joseph@intel.com \
--cc=john.fastabend@gmail.com \
--cc=kuba@kernel.org \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=vedang.patel@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).